All Joan customer data is stored in EU-based data centers located in Belgium, hosted on Google Cloud Platform. Data never leaves the European Union.

Yes. Joan is fully GDPR compliant. All data processing is lawful and transparent. Customers can request data access, rectification, erasure, or portability at any time. A Data Processing Agreement (DPA) is available upon request.

Yes. Visionect d.o.o., the company behind Joan, holds ISO/IEC 27001:2022 certification for its company-wide Information Security Management System. The certificate is independently audited with annual surveillance reviews.

All communication between Joan devices and servers is encrypted using TLS 1.3. Data at rest is encrypted using industry-standard protocols within Google Cloud Platform.

Upon account termination or a deletion request, customer data is removed in accordance with our data retention policy and applicable legal requirements. Contact [email protected] for details.

No. Calendar data is accessed only when required and cached temporarily in memory. It is never permanently stored on the device. Lost or stolen devices can be deauthorized remotely from the Joan portal.

A penetration test summary is available under NDA. Contact [email protected] to request access.

It is mandatory for all employees to use MFA (2FA) for remote access to key company systems. This is enforced through our hardened service account policies.

Yes, all our employees undergo mandatory and regular security awareness training. This training begins during onboarding and is conducted periodically to ensure staff remain updated on evolving security risks.

Yes, we have a data classification policy that includes protection, labeling, and handling. Our policy defines data into three levels: Public, Internal, and Confidential. This classification guides the required protection measures, handling procedures, and access restrictions for all information assets.

The standard retention period for the Joan data is 12 months. Storing the data is necessary for Joan analytical features.

We have implemented a multi-layered approach to data loss prevention through a combination of technical and procedural controls. Our data leakage prevention measures are based on our risk assessment and include data encryption during transmission and storage, strict access controls, and network security measures like firewalls and secure VPNs.

Yes, we implement multiple network security controls to protect our networks. Our security solutions include logical network separation, network access control, strong authentication, and strong encryption for data in transit (TLS 1.3).

Yes, access to our information systems is strictly restricted based on roles, responsibilities, and the principle of least privilege. Our access control policy ensures that users are granted only the minimum access rights necessary to perform their job duties. Privileged access is strictly controlled, limited to essential personnel, and reviewed regularly.

We have established comprehensive processes to ensure compliance with data protection and privacy legislation, including GDPR. We continuously monitor legal and regulatory requirements and conduct regular risk assessments and both internal and external audits to maintain compliance. All our software and systems are designed and operated in adherence to applicable data processing regulations. Our commitment is further demonstrated through our ISO 27001 certification and by having a dedicated legal team monitor contractual obligations.

Yes, we have a formal Business Continuity Management (BCM) system to ensure uninterrupted business operations. We have established rigorous backup and restoration procedures, and these restoration processes are regularly tested to ensure swift recovery. Our business continuity plans are reviewed and tested regularly to confirm their suitability and effectiveness, with all testing recorded in test reports.

Yes, we regularly scan our systems, infrastructure, and endpoints for vulnerabilities. Our vulnerability management process includes proactive monitoring of industry trends and threat intelligence, as well as periodic vulnerability scanning of our entire system, which is performed at least annually or more frequently if necessary. This approach allows us to identify and remediate potential weaknesses. We also maintain a formal patch management policy to ensure that all company-operated systems, software, and employee devices are kept up-to-date with the latest security patches.

Yes, we have a formal risk management process aligned with ISO 27001 standards as part of our Information Security Management System (ISMS). Risks that exceed our defined acceptance threshold are addressed through appropriate treatment measures, such as implementing new controls, formal acceptance, or transferring the risk.

Yes, we evaluate the performance of our information security program through regular internal and external audits. Our Information Security Management System (ISMS) is subject to regular audits, including certification audits against the ISO 27001 standard. Internal audits are conducted at least annually, or when significant changes occur, to evaluate the effectiveness and compliance of our internal processes, systems, and controls. The results of these audits ensure our security policies and procedures remain relevant and effective and drive continuous improvement of our security program.

Yes, we maintain an established Information Security Policy which is the cornerstone of our Information Security Management System (ISMS). To ensure its continued relevance and effectiveness, the policy is reviewed regularly.

Yes, confidential and personal data are encrypted both in transit and at rest. We utilize strong encryption mechanisms to protect sensitive data during transmission and while stored. For data in transit, all our critical services and communications, including remote access, use strong encryption like TLS 1.3 and encrypted HTTPS connections. For data at rest, we enforce encryption on all company-owned mobile devices and laptops, and sensitive data is stored on secure, access-controlled cloud platforms rather than locally on devices.

Yes, our Information Security Management System (ISMS) is certified against the ISO 27001 standard. Our ISMS is subject to regular internal and external audits, including annual certification audits conducted by an accredited certification body. While we do not hold SOC or PCI-DSS certifications, our security practices are designed to align with industry best practices and comply with relevant regulations such as GDPR.

Yes, we conduct penetration testing on our information systems. To provide independent assurance, we engage an external partner annually to perform security and vulnerability assessments, which include penetration testing and vulnerability scanning, on our production code and systems. This testing typically occurs on pre-production or production environments and serves as a critical security validation step. Findings from these external assessments are reviewed, prioritized, and used to drive remediation efforts and improvements in our development practices.

Yes, we maintain a comprehensive inventory of our information assets, which includes hardware, software, documentation, and cloud infrastructure. Each asset is assigned an owner who is responsible for its management and security throughout its lifecycle. This process is a fundamental component of our Information Security Management System (ISMS).

Yes, all company-owned endpoint devices, including laptops and workstations, are equipped with antivirus software.

Yes, our organization performs background verification checks on all candidates, including employees and contractors, before granting them access to data. These checks are conducted prior to joining and are proportional to the business requirements, the classification of the information to be accessed, and the perceived risks. Our screening process includes candidate verification activities such as education verification, past employment history, and references, all carried out in accordance with applicable laws and internal procedures.

We have not experienced any data loss or security breaches. Our Business Continuity Management documentation confirms that we have had no data breach or data integrity incidents. We maintain a comprehensive incident management system to prevent and respond appropriately to any violations or potential violations of confidentiality, integrity, and availability.